Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.
Affected Versions:
- 8.x: All versions from 8.3.0 up to and including 8.19.23
- 9.x:
- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5
Affected Configurations:
- All APM Server deployments, standalone and Fleet-managed, are affected. OTLP/HTTP intake is enabled by default. OTLP/gRPC intake is not affected.
Solutions and Mitigations:
The issue is resolved in version 8.19.24, 9.4.9 and 9.5.6. The fixed versions reject OTLP/HTTP requests with a body larger than 64 MiB after decompression, as recommended by the OTLP specification.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-115716
Problem Type: CWE-770 - Allocation of Resources Without Limits or Throttling